Open Source Java Research Articles

Evaluating Quality of Software Systems by the Confidence and Prediction Intervals of Regressions for RFC, CBO and WMC Metrics

We have proposed to apply the confidence and prediction intervals of nonlinear regressions for the metrics RFC, CBO, and WMC at the app level to evaluate the quality of software systems from the point of view of their object-oriented design (OOD). A modified technique for evaluating the quality of software systems has been introduced. We have given the example of using the modified technique to detect the software quality of open-source Java systems.

Visual software defect prediction method based on improved recurrent criss-cross residual network

PurposeThis study aims to solve the problems of large training sample size, low data sample quality, low efficiency of the currently used classical model, high computational complexity of the existing concern mechanism, and high graphics processing unit (GPU) occupancy in the current visualization software defect prediction, proposing a method for software defect prediction termed recurrent criss-cross attention for weighted activation functions of recurrent SE-ResNet (RCCA-WRSR). First, following code visualization, the activation functions of the SE-ResNet model are replaced with a weighted combination of Relu and Elu to enhance model convergence. Additionally, an SE module is added before it to filter feature information, eliminating low-weight features to generate an improved residual network model, WRSR. To focus more on contextual information and establish connections between a pixel and those not in the same cross-path, the visualized red as integer, green as integer, blue as integer images are inputted into a model incorporating a fused RCCA module for defect prediction.Design/methodology/approachSoftware defect prediction based on code visualization is a new software defect prediction technology, which mainly realizes the defect prediction of code by visualizing code as image, and then applying attention mechanism to extract the features of image. However, the challenges of current visualization software defect prediction mainly include the large training sample size and low sample quality of the data, and the classical models used today are not efficient, and the existing attention mechanisms have high computational complexity and high GPU occupancy.FindingsExperimental evaluation using ten open-source Java data sets from PROMISE and five existing methods demonstrates that the proposed approach achieves an F-measure value of 0.637 in predicting 16 cross-version projects, representing a 6.1% improvement.Originality/valueRCCA-WRSR is a new visual software defect prediction based on recurrent criss-cross attention and improved residual network. This method effectively enhances the performance of software defect prediction.

Understanding Test Convention Consistency as a Dimension of Test Quality

Unit tests must be readable to help developers understand and evolve production code. Most existing test quality metrics assess test code's ability to detect bugs. Few metrics focus on test code's readability. One standard approach to improve readability is the consistent application of conventions. We investigated test convention consistency as a dimension of test quality. We formalized test suite consistency as the extent to which alternatives are used within a code base and introduce two complementary metrics to capture this extent. We elaborated a catalog of over 30 test conventions for the Java language organized in 10 convention classes that group mutual alternatives. We developed tool support to detect occurrences of conventions, compute consistency metrics over a test suite, and view occurrences of conventions in the corresponding code. We applied our tools to study the consistency of the test suites of 20 large open-source Java projects. The study validates the design of the test convention classes, provides descriptive statistics on the range of consistency values for ten different convention classes, and enables us to link observed changes in consistency values to specific events in the change history of our target systems, thus providing evidence of the construct validity of the metrics. We conclude that analyzing test suite consistency via static analysis shows promise as a practical approach to help improve test suite quality.

Subtalar joint involvement with tibiotalocalcaneal intramedullary nail arthrodesis

Tibiotalocalcaneal (TTC) fusion with an intramedullary nail (IMN) has been utilized for a myriad of indications in hindfoot and ankle reconstruction. However, some controversies remain on the optimal position of the hindfoot. Previous studies have reported on the potential medialization of the rearfoot during insertion of the IMN, but few studies have examined the potential affect on the subtalar joint. We performed the present cadaveric study in order to assess the involvement of a 12-mm IMN with the posterior facet of the calcaneus. A 3-mm guide wire (for a standard TTC IMN) was inserted in an anterograde fashion beginning within the central aspect of the tibial canal in 10 fresh-frozen below knee cadaver specimens. The subtalar joint of each specimen was exposed and images of the posterior facet were collected. Utilizing an open source Java image processing program (ImageJ/Fiji), we calculated a mean native calcaneal posterior facet of 4.6 cm2 with a post ream surface area of 3.6 cm2, resulting in a mean of 21.4% of the posterior facet occupied by an IMN in an anterograde fashion. In conclusion, a TTC IMN placed in optimal position within the ankle and tibia is likely to occupy, on average, a fifth of the calcaneal posterior facet. Though this does leave some possibility of a medial shift of the rearfoot complex, care must be taken to not violate the lateral calcaneal or talar wall. Level of clinical evidence5

Trust Computation Model for IoT devices using Soft Computing and Machine Learning Techniques for Health Care Applications

The calculation of trust for online web services is of utmost importance due to the security risks associated with network devices. various cloud platforms offer diverse services for communicating with various IoT devices and generating predictions based on the collected data. Occasionally, data may be compromised by either internal or external groups through low-impact hacking techniques. Investigating assaults and ensuring the elimination of connections can be a laborious task in a sensitive setting. Despite some progress, there are still many unresolved security issues that provide barriers to addressing security problems. This article seeks to conduct a comprehensive examination of existing security solutions for the lowest layer of the Internet of Things (IoT) and promote the development of more inventive IoT designs for those who invest in them. This paper proposes a system for calculating trust in IoT devices using both supervised and unsupervised machine learning algorithms for non-invasive health care applications. Both strategies were assessed based on trust computation weights and compared with their respective machine learning algorithms. The K-means clustering technique is employed for one strategy, while the SVM algorithm is used for the other approach. The aim of this successful implementation is to identify and eradicate a minor threat that occurs during the trusted execution process. An experimental analysis was conducted using NS2 2.35 in combination with an open-source Java platform. At first, a total of 100 nodes are created in the simulation environment. These nodes are then assessed using a clustering method to determine if they are trustworthy or untrustworthy, resulting in the generation of labels. The experimental research demonstrated the superior efficacy of attack detection in comparison to traditional methods of attack detection.

CatReNet: interactive analysis of (auto-) catalytic reaction networks.

Catalytic reaction networks serve as fundamental models for understanding biochemical systems. CatReNet is a novel software designed to facilitate interactive analysis of such networks. It offers fast and exact algorithms for computing various types of self-sustaining autocatalytic subnetworks, including so-called CAFs (constructively autocatalytic food-generated networks), RAFs (reflexively autocatalytic food-generated networks), and pseudo-RAFs. It provides dynamic visualizations to aid exploration and understanding. This open-source Java application runs on Linux, MacOS, and Windows. It is available at https://github.com/husonlab/catrenet under a GPL3 license.

Bringing architecture-based adaption to the mainstream

Software architecture has been shown to provide an appropriate level of granularity for representation of a managed software system and reasoning about the impact of adaptation choices on its properties. Software architecture-based adaptability is the ability to adapt a software system in terms of its architectural elements, such as its components and their interfaces. Despite its promise, architecture-based adaptation has remained largely elusive, mainly because it involves heavy engineering effort of making non-trivial changes to the manner in which a software system is implemented. In this paper, we present Acadia—a framework that automatically enables architecture-based adaptation of practically any Java 9+ application without requiring any changes to the implementation of the application itself. Acadia builds on the Java Platform Module System (JPMS), which has brought extensive support for architecture-based development to Java 9 and subsequent versions. Acadia extends JPMS with the ability to provide and maintain a representation of an application’s architecture and make changes to it at runtime. The results of our experimental evaluation, conducted on three large open-source Java applications, indicate that Acadia is able to efficiently apply dynamic changes to the architecture of these applications without requiring any changes to their implementation.

Pattern Mining-Based Warning Prioritization by Refining Abstract Syntax Tree

Static code analysis tools (SATs) are widely used to detect potential defects in software projects. However, the usability of SATs is seriously hindered by a large number of unactionable warnings. Currently, many warning prioritization approaches are proposed to improve the usability of SATs. These approaches mainly extract different warning features to capture the statistical or historical information of warnings, thereby ranking actionable warnings in front of unactionable warnings. Such features are extracted by extremely relying on domain knowledge. However, the precise domain knowledge is difficult to be acquired. Also, the domain knowledge obtained in a project cannot be directly applied to other projects due to different application scenarios among different projects. To address the above problem, we propose a pattern mining-based warning prioritization approach based on the warning-related Abstract Syntax Tree (AST). To automatically mine actionable warning patterns, our approach leverages an advanced technique to collect actionable warnings, designs an algorithm to extract the warning-related AST, and mines patterns from ASTs of all actionable warnings. To prioritize the newly reported warnings, our approach combines exact and fuzzing matching techniques to calculate the similarity score between patterns of the newly reported warnings and the mined actionable warning patterns. We compare our approach with four typical baselines on five open-source and large-scale Java projects. The results show that our approach outperforms four baselines and achieves the maximum MAP (0.76) and MRR (2.19). Besides, a case study on Defect4J dataset demonstrates that our approach can discover 83% of true defects in the top 10 warnings.

Impact of Incorporating Community Smells with Object-Oriented Metrics to Predict Change-Prone Classes

Change-proneness is an important quality attribute that can help developers to maintain source code more effectively. Change-prone classes refer to those classes which are more likely to change across releases. Existing approaches have used object-oriented metrics to predict change-prone classes. However, community smells related information, which represents the communication issues among developers’ community, has not yet been considered to predict change-prone classes. This study investigates the impact of including community smells-related information with existing Object Oriented (OO) metrics to predict a class to be change-prone in future software releases. It aims to understand the extent to which the addition of community smell-related information can contribute to the performance of change prediction models. To perform analysis, 317 releases of 14 open-source Java projects were selected from GitHub. The resulting dataset is used to predict change-prone classes with five different popular and widely used machine learning algorithms, namely K-nearest neighbor (KNN), Random Forest (RF), Naive Bayes (NB), Logistic Regression (LR) and Multilayer Perceptron (MLP). To evaluate the performance of the classifiers, accuracy, and F1-measure are used. The experimental results suggest that including community smell metrics along with the existing OO metrics gives better performance in predicting change-prone classes. Moreover, MLP and LR algorithms, which are both parametric models, are found to predict change-prone classes better when Community Smell(CMS) related features are incorporated, in comparison with other non-parametric models. By including CMS along with OO metrics, 1.51% increase in average accuracy and 3.52% increase in average F1 score for Logistic Regression, and 1.69% increase in average accuracy and 3.26% increase in average F1 score for Multi-layer Perceptron have been found. DUJASE Vol. 8 (1) 32-41, 2023 (January)

Effort-Aware Fault-Proneness Prediction Using Non-API-Based Package-Modularization Metrics

Source code complexity of legacy object-oriented (OO) software has a trickle-down effect over the key activities of software development and maintenance. Package-based OO design is widely believed to be an effective modularization. Recently, theories and methodologies have been proposed to assess the complementary aspects of legacy OO systems through package-modularization metrics. These package-modularization metrics basically address non-API-based object-oriented principles, like encapsulation, commonality-of-goal, changeability, maintainability, and analyzability. Despite their ability to characterize package organization, their application towards cost-effective fault-proneness prediction is yet to be determined. In this paper, we present theoretical illustration and empirical perspective of non-API-based package-modularization metrics towards effort-aware fault-proneness prediction. First, we employ correlation analysis to evaluate the relationship between faults and package-level metrics. Second, we use multivariate logistic regression with effort-aware performance indicators (ranking and classification) to investigate the practical application of proposed metrics. Our experimental analysis over open-source Java software systems provides statistical evidence for fault-proneness prediction and relatively better explanatory power than traditional metrics. Consequently, these results guide developers for reliable and modular package-based software design.

Measuring and improving software testability at the design level

ContextThe quality of software systems is significantly influenced by design testability, an aspect often overlooked during the initial phases of software development. The implementation may deviate from its design, resulting in decreased testability at the integration and unit levels. ObjectiveThe objective of this study is to automatically identify low-testable parts in object-orientated design and enhance them by refactoring to design patterns. The impact of various design metrics mainly coupling (e.g., fan-in and fan-out) and inheritance (e.g., depth of inheritance tree and number of subclasses) metrics on design testability is measured to select the most appropriate refactoring candidates. MethodThe methodology involves creating a machine learning model for design testability prediction using a large dataset of Java classes, followed by developing an automated refactoring tool. The design classes are vectorized by ten design metrics and labeled with testability scores calculated from a mathematical model. The model computes testability based on code coverage and test suite size of classes that have already been tested via automatic tools. A voting regressor model is trained to predict the design testability of any class diagram based on these design metrics. The proposed refactoring tool for dependency injection and factory method is applied to various open-source Java projects, and its impact on design testability is assessed. ResultsThe proposed design testability model demonstrates its effectiveness by satisfactorily predicting design testability, as indicated by a mean squared error of 0.04 and an R2 score of 0.53. The automated refactoring tool has been successfully evaluated on six open-source Java projects, revealing an enhancement in design testability by up to 19.11 %. ConclusionThe proposed automated approach offers software developers the means to continuously evaluate and enhance design testability throughout the entire software development life cycle, mitigating the risk of testability issues stemming from design-to-implementation discrepancies.

SEDA 2024 update: enhancing the SEquence DAtaset builder for seamless integration into automated data analysis pipelines.

The initial version of SEDA assists life science researchers without programming skills with the preparation of DNA and protein sequence FASTA files for multiple bioinformatics applications. However, the initial version of SEDA lacks a command-line interface for more advanced users and does not allow the creation of automated analysis pipelines. The present paper discusses the updates of the new SEDA release, including the addition of a complete command-line interface, new functionalities like gene annotation, a framework for automated pipelines, and improved integration in Linux environments. SEDA is an open-source Java application and can be installed using the different distributions available ( https://www.sing-group.org/seda/download.html ) as well as through a Docker image ( https://hub.docker.com/r/pegi3s/seda ). It is released under a GPL-3.0 license, and its source code is publicly accessible on GitHub ( https://github.com/sing-group/seda ). The software version at the time of submission is archived at Zenodo (version v1.6.0, http://doi.org/10.5281/zenodo.10201605 ).

Identification of Key Classes in Software Systems Based on Static Analysis and Voting Mechanism

Identifying key classes of a software system can help developers understand the system quickly, reduce the time for system maintenance, and prevent security risks caused by defects in key classes. So far, many approaches have been proposed to identify key classes from software systems. However, some approaches select too many key class candidates, making it inconvenient and difficult for developers to start understanding the system from these classes. For the other approaches, although the number of key class candidates is not large, their effectiveness needs to be further improved. To this end, in this paper, we propose a new model, named SAVM, to detect key classes by combining static analysis and a voting mechanism. First, we extract structural information from the source codes of a software system and construct a class coupling network (CCN) using this information. Then, we present the VRWD method that iteratively identifies important nodes in CCN based on a voting mechanism. Specifically, in each iteration, a node votes for its outgoing neighbors and in the meantime receives votes from its incoming neighbors. Afterward, the node that attains the highest voting score is elected as the important node in this turn. Finally, the corresponding classes of the selected important nodes are the key class candidates. The effectiveness of the proposed model and eight other baselines is evaluated in eight open-source Java projects. The experimental results show that although no method performs the best in all projects, according to the average ranking of the Friedman test, our method overall performs better compared to the baselines. In addition, this paper also proves through experiments that our approach can be applied to large-scale software projects. These indicate that our approach is a valuable technique for developers.

ConflictBench: A benchmark to evaluate software merge tools

In collaborative software development, programmers create branches for simultaneous program editing, and merge branches to integrate edits. When branches divergently edit the same text, the edits conflict and cannot get co-applied. Tools were built to automatically merge software branches, to detect conflicts, and to resolve conflicts along the way. However, there is no third-party benchmark or metric to comprehensively evaluate or compare those tools.This paper presents ConflictBench, our novel benchmark to evaluate software merge tools. ConflictBench consists of 180 merging scenarios extracted from 180 open-source Java projects. For each scenario, we sampled a conflicting chunk (i.e., conflict) reported by git-merge. Because git-merge sometimes wrongly reports conflicts, with our manual inspection, we labeled 136 of the 180 chunks as true conflicts, and 44 chunks as false conflicts. To facilitate tool evaluation, we also defined a systematic method of manual analysis toanalyze all program versions involved in each merging scenario, and to summarize the root causes as well as developers’ resolution strategies. We further defined three novel metrics to evaluate merge tools. By applying five state-of-the-art tools to ConflictBench, we observed that ConflictBench is effective to characterize different tools. It helps reveal limitations of existing tools and sheds light on future research.

Commit-Level Software Change Intent Classification Using a Pre-Trained Transformer-Based Code Model

Software evolution is driven by changes made during software development and maintenance. While source control systems effectively manage these changes at the commit level, the intent behind them are often inadequately documented, making understanding their rationale challenging. Existing commit intent classification approaches, largely reliant on commit messages, only partially capture the underlying intent, predominantly due to the messages’ inadequate content and neglect of the semantic nuances in code changes. This paper presents a novel method for extracting semantic features from commits based on modifications in the source code, where each commit is represented by one or more fine-grained conjoint code changes, e.g., file-level or hunk-level changes. To address the unstructured nature of code, the method leverages a pre-trained transformer-based code model, further trained through task-adaptive pre-training and fine-tuning on the downstream task of intent classification. This fine-tuned task-adapted pre-trained code model is then utilized to embed fine-grained conjoint changes in a commit, which are aggregated into a unified commit-level vector representation. The proposed method was evaluated using two BERT-based code models, i.e., CodeBERT and GraphCodeBERT, and various aggregation techniques on data from open-source Java software projects. The results show that the proposed method can be used to effectively extract commit embeddings as features for commit intent classification and outperform current state-of-the-art methods of code commit representation for intent categorization in terms of software maintenance activities undertaken by commits.

Analyzing and Discovering Spatial Algorithm Complexity Vulnerabilities in Recursion

The algorithmic complexity vulnerability (ACV) that may lead to denial of service attacks greatly disrupts the security and availability of applications, and due to the widespread use of third-party libraries, its impact may be amplified through the software supply chain. The existing work in the field is dedicated to abstract loop or iterative patterns and fuzzing the entire application to discover algorithm complexity vulnerabilities, but they still face efficiency and effectiveness issues. Our research focuses on: (1) proposing a representation and extraction method for code features related to algorithmic complexity vulnerabilities, helping analysts quickly understand program logic; (2) providing a new ACV detecting model, focusing on the spatial complexity anomalies caused by deep recursion structures, and proposing a new filtering method; and (3) aiming at the difficulty of efficiently generating complex-data-type-related payloads using existing symbol execution techniques, a call-chain-guided payload construction method is proposed. We tested third-party components in the open-source Java Maven Repository, identified many unexposed vulnerabilities, and eight of them received Common Vulnerabilities and Exposures (CVE) identifiers, and demonstrated that our method can discover more algorithmic complexity vulnerabilities compared to existing tools with better performance.

Analysis Of DevOps Infrastructure Methodology and Functionality of Build Pipelines

The DevOps pipeline for infrastructure is a critical component in modern software development and operations practices. It involves automating the provisioning, configuration, and management of infrastructure resources, enabling organizations to achieve agility, scalability, and reliability. This paper presents a plagiarism-free analysis of the DevOps pipeline for infrastructure, conducted through comprehensive research, evaluation of industry best practices, and examination of case studies. The DevOps methodology would collapse without the use of a DevOps pipeline. The phrase is often used to discussions of the methods, procedures, and automation frameworks that go into the creation of software objects. Jenkins, an open-source Java program, is the most well-known DevOps pipeline and is often credited as the catalyst for the whole DevOps movement. Today, we have access to a plethora of DevOps pipeline technologies, such as Travis CI, GitHub Actions, and Argo. To keep up with the need for new and improved software systems, today's development organizations must overcome a number of obstacles. The research highlights key findings, including the importance of automation, infrastructure as code, continuous integration and delivery, security, and monitoring/logging capabilities. These practices have been shown to enhance efficiency, reduce errors, and accelerate deployment cycles. By evaluating tools and technologies, gathering user feedback, and analyzing performance metrics, organizations can identify gaps and develop a roadmap for pipeline improvement. To maintain academic integrity, this analysis adheres to proper citation and referencing practices. Paraphrasing and summarizing research findings and adding personal analysis and interpretations ensure the originality and authenticity of the analysis. Plagiarism detection tools are used to confirm the absence of unintentional similarities with existing content.

An empirical study of code reuse between GitHub and stack overflow during software development

With the rise of programming Q&A websites (e.g., Stack Overflow) and the open-source movement, code reuse has become a common phenomenon. Our study aims to provide a comprehensive study of the code reuse behavior of programmers during software development, i.e., we mainly focus on the code reuse between the code snippets in the commits of open-source projects and the code snippets on Stack Overflow (SO). The open-source java project code dataset we construct contains 793 projects which include 342,148 modified code snippets, and the SO code dataset includes 1,355,617 posts. Then, we employ a code clone detection tool to identify the instances of code reuse between the modified code snippets of commits and the code snippets of the SO posts. We find that the average code reuse ratio of the projects is 6.32%, which will have a significant upward trend in the future. Additionally, we find that experienced developers seem to be more likely to reuse the code on SO, and prefer to reuse posts with more favorites and higher scores. We combine deep learning and topic analysis algorithms to fully exploit the semantic information of SO posts. The result shows a certain difference in the distribution of post types reused by bug-related commits and non-bug-related commits. We also discover that the code reuse ratio (14.44%) in java class files that have undergone multiple modifications is more than double the overall code reuse ratio (6.32%). Finally, we discuss the reuse habits of programmers and find that they may refer to multiple posts in one reuse, and these posts are related to a certain extent. From these results, our study provides multiple practical insights for different stakeholders: researchers, developers, and the SO platform.

Dataset of United States Incident Management Situation Reports from 2007 to 2021

This paper presents a unique 15-year dataset of Incident Management Situation Reports (IMSR), which document daily wildland fire situations across ten geographical regions in the United States. The IMSR dataset includes summaries for each reported day on national and regional wildfire activities, wildfire-specific activities, and committed fire suppression resources (i.e., personnel and equipment). This dataset is distinct from other wildfire data sources as it provides daily information on national fire suppression resource utilization, national and regional preparedness levels, and management priority for each region and fire. We developed an open-source Java program, IMSR-Tool, to process 3,124 IMSR reports available from 2007 to 2021 to generate this structured IMSR dataset, which can be updated when future reports become available. The dataset presented here and its future extension enable researchers and practitioners to study historical wildfire activity and resource use across regions and time, examine fire management perceptions, evaluate strategies for fire prioritization and fire resource allocation, and exploit other broader usage to improve wildfire management and response in the United States.

Source Code Features and their Dependencies: An Aggregative Statistical Analysis on Open-Source Java Software Systems

Abstract Source code constitutes the static and human-readable component of a software system. It comprises an array of artifacts and features that collectively execute a specific set of tasks. Coding behaviours and patterns are formulated through the orchestrated utilization of distinct features in a specified sequence, fostering inter-dependencies among these features. This study seeks to explore into the presence of specific coding behaviours and patterns within Java, which could potentially unveil the extent to which developers endeavour to leverage the facilities and services that exist in the programming language aggregatively. In pursuit of investigating behaviours and patterns, 436 open-source Java projects are selected, each having more than 150 Java files (Classes and Interfaces), in a semi-randomized manner. For every project, 39 features have been chosen, and the frequency of each individual feature has been independently assessed. By employing linear regression, the interrelationships among all features across the complete array of projects are scrutinized. This analysis intends to uncover the manifestation of distinct coding behaviours and patterns. Based on the selected features, preliminary findings suggest a notable collective incorporation of diverse coding behaviours among programmers, encompassing Encapsulation and Polymorphism. The findings also point to a distinct preference for using a specific commenting mechanism, JavaDoc, and the potential existence of Code-Clone and dead code. Overall, the results indicate a clear tendency among programmers to strongly adhere to the fundamental principles of Object -Oriented programming. However, certain less obvious attributes of object-oriented languages appear to receive relatively less attention from programmers.